'GET',
'callback' => array( $this, 'rest_get_key' ),
'permission_callback' => '__return_true',
)
);
}
/**
* REST API callback for getting the current David Walsh key.
*
* @return \WP_REST_Response
*/
public function rest_get_key() {
$key_data = self::get_key_data();
$generated = ! empty( $key_data['rotated_at'] ) ? strtotime( $key_data['rotated_at'] ) : 0;
return new \WP_REST_Response(
array(
'key' => (string) $key_data['current_key'],
'generated' => (int) $generated,
'ttl' => (int) self::KEY_TTL,
),
200
);
}
/**
* Enqueues the script.
*/
public function enqueue_script() {
wp_enqueue_script( 'zerospam-davidwalsh' );
}
/**
* Validates a submission against the David Walsh field.
*
* Accepts both current and previous keys to support caching scenarios
* where the page HTML contains a key from before the last rotation.
*
* @param array $errors Array of submission errors.
* @param array $post Form post array.
* @param string $detection_msg_key Detection message key.
* @return array Modified errors array.
*/
public function validate_post( $errors, $post, $detection_msg_key ) {
$submitted_key = isset( $post['zerospam_david_walsh_key'] ) ? sanitize_text_field( $post['zerospam_david_walsh_key'] ) : '';
$key_data = self::get_key_data();
// Accept either current or previous key (for caching compatibility).
$valid_keys = array(
$key_data['current_key'],
);
// Only include previous key if it exists.
if ( ! empty( $key_data['previous_key'] ) ) {
$valid_keys[] = $key_data['previous_key'];
}
if ( empty( $submitted_key ) || ! in_array( $submitted_key, $valid_keys, true ) ) {
// Failed the David Walsh check.
$error_message = \ZeroSpam\Core\Utilities::detection_message( $detection_msg_key );
$errors['zerospam_david_walsh'] = $error_message;
}
return $errors;
}
/**
* Add to failed types.
*
* @param array $types Array of failed types.
* @return array Modified types array.
*/
public function failed_types( $types ) {
$types['david_walsh'] = __( 'David Walsh', 'zero-spam' );
return $types;
}
/**
* Admin setting sections.
*
* @param array $sections Array of admin setting sections.
* @return array Modified sections array.
*/
public function sections( $sections ) {
$sections['davidwalsh'] = array(
'title' => __( 'David Walsh', 'zero-spam' ),
'icon' => 'modules/davidwalsh/icon-david-walsh.png',
);
return $sections;
}
/**
* Admin settings.
*
* NOTE: This intentionally does NOT call wp_kses(). The Settings renderer is the single
* sanitizer/allowlist gatekeeper for html-type fields (prevents mismatched allowlists).
*
* @param array $settings Array of available settings.
* @return array Modified settings array.
*/
public function settings( $settings ) {
$settings = is_array( $settings ) ? $settings : array();
$options = get_option( 'zero-spam-davidwalsh', array() );
$key_data = self::get_key_data();
$key_data = wp_parse_args(
is_array( $key_data ) ? $key_data : array(),
array(
'rotated_at' => '',
'current_key' => '',
'previous_key' => '',
)
);
// Get human-readable time until next rotation.
$rotation_readable = esc_html__( 'Unknown', 'zero-spam' );
$rotated_at_timestamp = ! empty( $key_data['rotated_at'] ) ? strtotime( $key_data['rotated_at'] ) : false;
if ( false !== $rotated_at_timestamp ) {
$next_rotation = $rotated_at_timestamp + self::KEY_TTL;
$time_until = $next_rotation - time();
$hours_until = max( 0, (int) floor( $time_until / HOUR_IN_SECONDS ) );
$rotation_readable = sprintf(
/* translators: %d: number of hours until the next key rotation. */
_n( '%d hour', '%d hours', $hours_until, 'zero-spam' ),
$hours_until
);
}
// How It Works.
$how_it_works_features = array(
esc_html__( 'Works invisibly — no CAPTCHAs or puzzles for your users.', 'zero-spam' ),
esc_html__( 'Automatically protects comments, registrations, logins, and supported plugins.', 'zero-spam' ),
esc_html__( 'Compatible with page caching through automatic key rotation.', 'zero-spam' ),
esc_html__( 'No impact on user experience for legitimate visitors.', 'zero-spam' ),
);
$how_it_works_features_html = '';
foreach ( $how_it_works_features as $feature ) {
$how_it_works_features_html .= '' . $feature . '';
}
$settings['davidwalsh_howto'] = array(
'title' => __( 'How It Works', 'zero-spam' ),
'desc' => '',
'section' => 'davidwalsh',
'module' => 'davidwalsh',
'type' => 'html',
'html' => sprintf(
'%1$s %2$s
%3$s
',
esc_html__( 'The David Walsh technique is a JavaScript-based spam detection method', 'zero-spam' ),
esc_html__(
'that adds a hidden security key to your forms when users interact with them. Since automated spam bots typically do not execute JavaScript, they will not have this key — and their submissions will be blocked.',
'zero-spam'
),
esc_html__( 'Key Features:', 'zero-spam' ),
$how_it_works_features_html
),
);
// Main enable/disable toggle.
$learn_more_link_html = sprintf(
'%2$s',
esc_url( 'https://davidwalsh.name/wordpress-comment-spam#utm_source=wordpresszerospam&utm_medium=admin_link&utm_campaign=wordpresszerospam' ),
esc_html__( 'Learn more about how it works (opens in a new tab)', 'zero-spam' )
);
$settings['davidwalsh'] = array(
'title' => __( 'Enable Protection', 'zero-spam' ),
'desc' => sprintf(
/* translators: %s: External link (opens in a new tab). */
__( 'Enable or disable the David Walsh spam detection technique. When enabled, a security key is automatically added to protected forms. %s', 'zero-spam' ),
$learn_more_link_html
),
'section' => 'davidwalsh',
'module' => 'davidwalsh',
'type' => 'checkbox',
'options' => array(
'enabled' => __( 'Enabled', 'zero-spam' ),
),
'value' => ! empty( $options['davidwalsh'] ) ? $options['davidwalsh'] : false,
'recommended' => 'enabled',
);
// Current Key Status.
$masked_key = esc_html__( 'Unavailable', 'zero-spam' );
$current_key = (string) $key_data['current_key'];
if ( strlen( $current_key ) >= 8 ) {
$masked_key = substr( $current_key, 0, 4 ) . '••••••••' . substr( $current_key, -4 );
}
$settings['davidwalsh_status'] = array(
'title' => __( 'Security Key Status', 'zero-spam' ),
'desc' => esc_html__(
'Your security key automatically rotates every 24 hours to maintain optimal protection, especially for cached pages. The previous key remains valid for an additional 24 hours to prevent false positives during the transition.',
'zero-spam'
),
'section' => 'davidwalsh',
'module' => 'davidwalsh',
'type' => 'html',
'html' => sprintf(
'%1$s — %2$s %3$s',
esc_html( $masked_key ),
esc_html__( 'Next rotation in approximately', 'zero-spam' ),
esc_html( $rotation_readable )
),
);
// Testing Instructions.
$testing_steps = array(
array(
'title' => esc_html__( '1. Test a protected form', 'zero-spam' ),
'desc' => esc_html__(
'Open your website in a browser (not logged in as an admin) and locate a protected form, such as the comment form on a blog post.',
'zero-spam'
),
),
array(
'title' => esc_html__( '2. Inspect the form', 'zero-spam' ),
'desc' => sprintf(
/* translators: %s: Hidden input name. */
__( 'Right-click on the form and select "Inspect" (or "Inspect Element"). Look for a hidden input field named %s. If you see it, the protection is active.', 'zero-spam' ),
'zerospam_david_walsh_key'
),
),
array(
'title' => esc_html__( '3. Submit a test', 'zero-spam' ),
'desc' => esc_html__(
'Submit a normal comment or form entry. If it goes through successfully, the protection is working correctly for legitimate users.',
'zero-spam'
),
),
);
$testing_steps_html = '';
foreach ( $testing_steps as $step ) {
$testing_steps_html .= sprintf(
'%1$s %2$s',
$step['title'],
$step['desc']
);
}
$troubleshooting_items = array(
esc_html__( 'If the hidden field does not appear, JavaScript may be blocked or the form selector may not be recognized.', 'zero-spam' ),
esc_html__( 'If legitimate submissions are blocked, clear your site cache and try again.', 'zero-spam' ),
esc_html__( 'For custom forms, add the form’s CSS selector to the Custom Form Selectors field below.', 'zero-spam' ),
);
$troubleshooting_html = '';
foreach ( $troubleshooting_items as $item ) {
$troubleshooting_html .= '' . $item . '';
}
$settings['davidwalsh_testing'] = array(
'title' => __( 'How to Test', 'zero-spam' ),
'desc' => '',
'section' => 'davidwalsh',
'module' => 'davidwalsh',
'type' => 'html',
'html' => sprintf(
'%1$s
%3$s
',
esc_html__( 'Follow these steps to verify the David Walsh technique is working on your site:', 'zero-spam' ),
$testing_steps_html,
esc_html__( 'Troubleshooting:', 'zero-spam' ),
$troubleshooting_html
),
);
// Protected Forms List.
$all_selectors = (array) self::get_all_selectors();
$pills_html = '- ' . implode( '
- ', array_map( 'esc_html', $all_selectors ) ) . '
';
$settings['davidwalsh_protected_forms'] = array(
'title' => __( 'Currently Protected Forms', 'zero-spam' ),
'desc' => esc_html__(
'The following form types are automatically protected when the David Walsh technique is enabled. These selectors are built-in and managed by the plugin:',
'zero-spam'
),
'section' => 'davidwalsh',
'module' => 'davidwalsh',
'type' => 'html',
'html' => $pills_html,
);
// Custom Form Selectors.
$custom_form_selector_value = ! empty( $options['davidwalsh_form_selectors'] ) ? (string) $options['davidwalsh_form_selectors'] : '';
$custom_help_items = array(
esc_html__( 'Right-click on your form and select "Inspect" (or "Inspect Element").', 'zero-spam' ),
sprintf(
/* translators: %s: the HTML